Downtown Doug Brown

After I wrote about the possibility of programmable Mac ROM SIMMs in Quadras a couple of months ago, I suspected that there had been a way for developers at Apple in the 68k Mac era to reflash the ROM in their Macs during development, just like BIOS updates on PCs. The reason I believed this is because the ROM SIMM socket in the Quadras brought out pins for 12V (VPP) and write enable (/WE). I had verified that the write enable pin was going into the memory controller chip in several Mac models, so I was pretty confident that in-system programming was possible.

As luck would have it, multiple people pointed out to me that an Apple internal utility used for ROM flashing had been uploaded to the Macintosh Garden. It was recovered from a prototype PowerBook 520 purchased in 2020. Of course, I had to download this utility and figure out how it works.

I ran it on my LC 475 and this is what it looked like:

Here’s the About dialog, identifying Carl C. Hewitt as the author:

As you can see, it says the SIMM type is “Read-Only ROM” and the Program button is grayed out. This makes perfect sense, because it was just detecting my logic board’s mask ROM chips which are definitely not programmable.

All I was able to do was go to the File menu and choose “Save Onboard ROM…” to dump my existing ROM. It defaulted to a filename of “Saved RomMondo”. Then I could use the Verify button to show that my onboard ROM matched the dump:

This is all very interesting, but I wanted to see what it was like to actually flash a new ROM image. I wasn’t really sure where to begin though. Would this utility even support any of my Macs? What kind of ROM module would I need? What would it take to get that Program button enabled?

In order to answer these questions, I had no choice but to start disassembling the Flasher™ utility. Fortunately, a lot of the functions in the program had their names present as a string directly afterward so it gave me some context about what was going on. The holy grail was when I discovered this big table of entries for compatible ROMs. The names of these table entries, and the table itself, were assigned by me.

A lot of the entries in this table are PDS cards. You can even see in the main UI screenshots above that there was a separate “PDS ROM Info” section on the right. I would love to see an example of what these PDS cards looked like, if anyone out there has some inside knowledge they would be willing to share!

Let’s look at one of the SIMM entries in detail: QuadraSIMM1.

This contains a lot of info, and I had to do further disassembly throughout the program to understand what everything meant. 0x89898989 and 0xBDBDBDBD are the flash manufacturer and device ID, repeated four times because four 8-bit chips will respond at a time on the 32-bit data bus. 0x89 is Intel’s JEDEC manufacturer ID and 0xBD is the device ID for their 28F020 256-kilobyte flash chip. 0x40400000 is the base address for ROM write cycles, 0x40800000 is the base address for ROM read cycles, and 0x100000 is the size of each set of four chips (1 MB). This particular SIMM appears to have 2 banks, so it is likely a 2 MB SIMM with 8 flash chips.

After that, there are various flags for special options, and a jump table for functions to perform different operations like checking presence of the SIMM, erasing, and programming. I won’t go too far into the weeds about what it all means, but the other interesting part is at the end of the structure, which contains a NULL-terminated list of allowed gestalt machine IDs. We determined in my 68kmla post that the IDs listed above that don’t have names are simply unreleased variants of the other models for the most part. For example, 86, 90, 93, and 95 are gestalt IDs for unreleased variants of the LC 475 and Quadra 605 running at 20 MHz and 33 MHz instead of the final 25 MHz version.

So what does all this info tell us? Well, there is code elsewhere in the program that loops through the entire table one-by-one trying to determine if any items in the table are installed in the Mac it’s running on. Looking through this table allows me to get an idea of which Macs this program is compatible with as well as which flash chips a compatible ROM SIMM would need to use.

In the case of Quadras, it appears that a wide variety of them are all supported by the same code. The 700, 900, 950, 610, 650, 800, 475, 575, 630, and 580 are all handled by the table entry depicted above. There are also similar table entries for a 4-chip Intel 28F020 SIMM and 4- and 8-chip AMD 28F020 SIMMs. The 660av and 840av are supported by a couple of separate table entries for 8-chip 28F020 SIMMs with Intel and AMD parts. If you want to learn about other compatible Macs, see the 68kmla post I linked earlier. Before I get people’s hopes up too far, this utility doesn’t support earlier Macs like the SE/30 or II series. The only exception to that is the IIvx/IIvi/Performa 600.

It was around this time that I made a stupid mistake with my multimeter while checking out the SIMM /WE pin, and I think I fried it on my LC 475 by accidentally shorting it to 12V. They are right next to each other in the socket. My bad! Since then, I’ve bought another logic board for it so I can continue my experiments. Even though I now have a new logic board in my LC 475, I’ve moved over to doing most of my research on my Performa 630 instead.

At least my mistake gave me the opportunity to show this machine off. Notice that it’s a Performa 630; not a Performa 630CD. See that thing that suspiciously looks like a CD-ROM drive on the left? It’s not. It’s a blank cover to put something in the opening where the CD tray would come out. This is what the 630 series machines looked like when they didn’t come from the factory with a CD drive. And yes, as I’m sure many others did too, I pressed the button thinking the CD tray would come out. If you push the button hard enough, it gets stuck back in there. Don’t ask me how I found that out.

Anyway, the next step was to figure out how I could find a compatible SIMM to try this program out with. The programmable SIMMs that I designed in the past wouldn’t work. None of their chip IDs match, and my pinout for write enable was different. Not to mention they don’t properly disable the onboard ROMs. Looking deeper, modern flash chips use different programming commands and algorithms than the chips Apple supported anyway.

You may remember that I mentioned in my last post about Josh Watson finding an Apple programmable “Lobos board” SIMM on eBay a while ago. Here’s the 68kmla thread about that if you’re interested. Josh’s pictures clearly showed a board with four Am28F020 chips — one of the known compatible chip arrangements based on my disassembly. His pictures were detailed enough, and I’m familiar enough with the 64-pin ROM SIMM pinout, that I was able to reverse-engineer the entire PCB by looking at the pictures. I designed a replica in KiCad. It’s not exactly identical, but it’s very close to it.

It’s a 4-layer PCB just like the original. That sure makes routing ground and 5V a lot easier! I ordered five boards. In the meantime, I also ordered some new-old-stock Am28F020-120 chips on eBay. Then I just had to wait for things to arrive and put it all together!

There was still a challenge to solve though. I needed a way to put an initial ROM image onto this thing. You can’t program it in-system if it’s blank. As soon as it’s inserted into the ROM SIMM socket, it disables the onboard ROMs. Plus, it’s not compatible with my SIMM programmer because it needs 12V for VPP, and /WE is in a different place. You need to use something else to bootstrap it. That’s why I installed PLCC sockets on it rather than soldering the chips down. I used my XGecu T56 programmer, which helpfully also provides the ability to interleave a file across 4 chips:

By the way, I did notice an annoying issue with this programmer and the Am28F020 while I was playing around with it. If I tell it to erase the chip, it doesn’t fully erase. Most of the bits erase, but a few of them don’t. I have to erase twice in order to fully erase the chip. I tried contacting XGecu about this issue but they didn’t respond to my question. My guess is XGecu made a small mistake in the erase algorithm.

Even though my SIMM programmer is unable to program these chips, I was still able to use it to test the programmed SIMM contents and make sure they matched the stock 630 ROM. This made me feel much safer about sticking an untested PCB design into my Performa. I was also paranoid about making sure pin 2 (12V) wasn’t mistakenly shorted anywhere else on the SIMM, so I carefully double checked with my multimeter.

Next up, I needed my Performa 630 to actually have a ROM SIMM socket. Most machines of this era don’t come with the socket populated. Mine didn’t have the socket, and also needed to be recapped. You can see the footprint for the 64-pin socket with the holes filled with solder.

Back when I was making ROM SIMMs and programmers, I bought a bunch of sockets. So that wasn’t a problem at all. I got out my Hakko 808 vacuum desoldering tool and emptied out the holes. This was a breeze and allowed me to easily solder in a socket. Here it is with the socket populated and my new SIMM inserted.

With my reproduction Lobos SIMM installed, I was finally ready to boot up and run the Flasher utility again. The first good sign was that the machine still booted with the SIMM installed. I kind of expected that part to succeed since my programmer was able to read it, but it was still good news.

That’s more like it! Flasher detected a programmable “AMD 28F020 x 4” SIMM. The Program button was enabled! In order to try in-system programming, I created a hacked ROM containing a custom startup chime. If you’ve been following my blog for a while, you may know that I’ve always loved being able to mess around with Mac startup sounds. I might make the sound customization the subject of a future blog post, but for now let’s just assume that part has already been taken care of.

In order to use the new ROM file “630 New ROM” in the screenshot above, I had to use ResEdit to change the type and creator code of the file. The type code is ‘ROM ‘ and the creator code is ‘HIRM’. This would have taken more disassembly to figure out, so I’m glad that the program also supports saving ROM dumps which made it easy to find the correct codes.

Now that I had a brand new ROM file ready to go, I was finally ready to load the file and program it to the SIMM. Here’s a video showing the entire flashing process. You might enjoy hearing the clickety-clack sound of the original hard drive still in this thing.

My new ROM is identical to the original 630-series ROM, except it plays the Power Mac 6200/6300 startup sound instead — my favorite old Mac startup sound!

If I were a particularly evil person, I could definitely create some confusion with this new startup sound if I replaced the label on the front with one of these Apple service replacement labels I recently bought on eBay from Sun Remarketing’s old inventory…

But don’t worry. I would never do such a terrible thing.

What can we do with everything I’ve learned from this experiment? I believe it would technically be possible to hack the Flasher program so that it would recognize newer flash chips such as the SST39SF040. Basically I would have to modify one of the table entries to match a modern chip ID, and also hack the functions that do identification/erasure/programming to perform the sequences used by modern chips instead of the older 28F020 chips.

It would probably be easier to just make a new flasher program instead, but at the same time I think there would be something really cool about being able to use Apple’s own internal utility if this actually becomes a thing. If I find some spare time in the future, I may very well look into modifying it.

That would take care of the software changes needed, but as you may remember from my last post about Mac ROM SIMMs, there is also a hardware problem to solve. It would be nice to have a ROM SIMM that is compatible with in-system programming in these machines but also compatible with older machines and all of the SIMM programmers out there based on my original design. It turns out a solution for this is in the works from some smart people out there.

One last thing I want to reiterate about this: it would only be useful for people who have a ROM SIMM socket installed on their logic board. Not many supported machines out there today have the socket populated, with the exception of the Quadra 700/900/950. It’s definitely possible to solder the socket in like I did, but it’s not going to be a fun time if you don’t have a vacuum tool to clear the holes.

Now we have all seen what it was like for developers at Apple in the ’90s to reprogram the ROMs in their development Macs. I wonder how long it has been since someone last used this program to flash a Mac before I resurrected it this week? I do know that it was still in use during the PowerPC era. A newer version of this same program was used for Power Mac 7500/8500/9500 development. You can find it on this PCI Power Macintosh DDK disk.

Does anyone out there know more about how Mac ROM development worked back in the day? What if you accidentally screwed up and made your SIMM unbootable? There must have been some recovery method, right? Was that one of the reasons for the existence of the PDS cards I mentioned earlier? Or was there some other external SIMM programmer device that could reflash them? I’d love to hear more about it.